Contract: XS-HTX-2026-VT-001
D218 • CORS SSO Chain
AUTHORIZED ASSESSMENT — CONFIDENTIAL

C-HTX-350 — Full CORS SSO Chain PoC

Subdomain takeover → ticket/get → all-gateway token acquisition

0
Tokens Obtained
0
CORS Requests
0
Cookies Visible

Environment Check

Checking environment...

Live PoC Controls

[PoC loaded — run Environment Check first]

Chain Steps

  1. Page hosted on controlled *.htx.com subdomain (dangling CNAME takeover)
  2. Read document.cookie — Domain=.htx.com, HttpOnly=false → HB-UC-TOKEN, HB-PRO-TOKEN visible
  3. Generate vToken (any 32-char hex accepted by server)
  4. CORS GET ticket/get with HB-UC-TOKEN header + credentials:include → SSO ticket
  5. CORS POST pro/login with ticket → HB-PRO-TOKEN refreshed
  6. CORS POST otc/login with ticket → hb-otc-token set
  7. All gateway tokens obtained → full account access
Xiagu Security • Authorized Assessment C-HTX-350 • 2026